The Callable Hiding in the Table Row: Drupal’s Critical Field UI RCE Gets a Public PoC

2026-10-20 AI Vulnerabilities & CVEs by al-ice.ai Editorial

Six days after Drupal’s security team shipped the patch, the exploit chain is public. On 20 October 2026, FORTBRIDGE researcher Adrian Tiron published a full technical analysis with lab exploit code for CVE-2026-108097, the critical remote-code-execution flaw in Drupal core’s Field UI module disclosed in SA-CORE-2026-014 on 14 October. In the lab, the chain runs from file disclosure to full command execution without logging in. If you run Drupal and have not patched yet, the window between “theoretical” and “weaponised” just closed.

The core defect is brutally simple. A single line in Field UI executes whatever PHP callable a table row names — one field of row data is treated as code. Drupal core alone cannot reach that line from the outside, which is why the advisory carries the qualifier that matters most: the flaw “is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules,” and “at least one known exploit path does not require authentication.” An attacker additionally needs a module that passes request data into those rows. That is the whole threat model in one sentence: core ships the gun, and any module — or any line of custom code — that funnels user input into Field UI tables pulls the trigger.

Two advisories, one defect shape

The same day, Drupal published a sister advisory that proves the shape is not a one-off. SA-CONTRIB-2026-218 fixes CVE-2026-108099, a remote-code-execution vulnerability in the contributed Entity List module (all versions below 3.0.10, fixed in 3.0.10), which offers entity listing without Views. Its advisory language mirrors core almost word for word: not directly exploitable with the module alone, multiple serious paths with other contributed modules, at least one pre-authentication, custom code may also expose it. Both advisories are rated Critical 19/25 with the same vector (AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default). The core issue was reported by Drew Webber (mcdruid) of the Drupal Security Team; the Entity List issue by Lee Rowlands (larowlan) and Dave Long (longwave).

The affected core population is enormous: every supported branch from 8.9.0 through 10.6.18, 11.0.0 through 11.3.18, 11.4.0 through 11.4.9, and 12.0.0 pre-releases before beta2. The fix versions are 10.6.19, 11.3.19 and 11.4.10; branches 10.5.x, 11.2.x and below are end-of-life and get nothing. Note the Entity List connection explicitly: FORTBRIDGE found that the only previously known public bridge — the module that passed request data into the vulnerable rows — was Entity List itself, now fixed separately. Which leaves the uncomfortable remainder: with the public bridge closed, real exposure likely lives in custom code that nobody has audited for this pattern.

What the public PoC changes

FORTBRIDGE’s write-up does two things. First, it documents the mechanism precisely enough that any competent reader can recognise the pattern in their own modules. Second, it releases research code on GitHub that demonstrates the full chain in a lab, using a synthetic bridge module to stand in for the missing link. The team is explicit about the limitation: it found no public module today that completes the chain against a stock install. No exploitation in the wild has been confirmed, and the flaw is not in CISA’s Known Exploited Vulnerability catalog.

Do not read that as reassurance. A published lab chain plus a well-described precondition (“any code that feeds request data into Field UI tables”) is exactly the material from which targeted exploits are built, and the precondition is satisfied most often by bespoke code that scanners cannot fingerprint. The Drupal Security Team’s own interim mitigation tells the story: uninstall the core field_ui module and the primary exploit precondition disappears. Sites behind Drupal Steward get protection against some known vectors, but the advisory is candid that Steward coverage is partial and further attack vectors may surface. A stopgap that warns it does not cover everything is not a patch.

What to do this week

First, patch or remove. Update to 10.6.19, 11.3.19 or 11.4.10, plus Entity List 3.0.10 where used. If you cannot update, uninstall field_ui — on many production sites it is an administrative convenience that was never disabled after launch, and removing it costs nothing. Second, audit the custom layer. Grep custom and site-specific modules for anything that writes request-derived data into Field UI render structures; that is the bridge an attacker needs, and it is yours, not Drupal’s. Third, assume the files directory is the target. Watch for unexpected changes under the files directory and its .htaccess, the persistence surface this class of flaw tends to reach for.

The broader lesson is one this month keeps teaching across stacks: the dangerous primitive ships inside the trusted core, inert until something nearby hands it attacker-controlled input. It is the same week’s story as the TYPO3 batch that put an OpenAI key on every backend page and the Apache Answer release where one visibility gate held and twelve side doors did not — CMS-layer flaws whose exploitability is decided not by core alone but by the modules and custom code around it. Audit the neighbourhood, not just the house.

Our verification was read-only. The advisory dates, severity ratings, affected-version ranges, fix versions, Entity List 3.0.10 remediation, field_ui uninstall mitigation, Drupal Steward limitations and reporter credits were read first-hand from SA-CORE-2026-014 and SA-CONTRIB-2026-218 on drupal.org. The PoC publication date, file-disclosure-to-command-execution lab result, synthetic-bridge-module caveat, absence of a currently exploitable public module, and unconfirmed in-the-wild status were read first-hand from FORTBRIDGE’s analysis via SecurityOnline.info. No target system was probed. Brave Search was used for discovery only.

Sources: